Good luck on the recovery -- folks here are hoping for you.

Needless to say I won't be allowing the teenager near my HD again.

Apologies for pointing it out, but a $2 DVD/CD backup or two would have saved a lot of stress and anxiety. If the eggs are in ONE basket, then it's just a matter of time before the basket fails or is lost through other means (virus, theft, virus, fire, virus, lost or Xray zapped airline luggage from England, virus, etc). Sonny merely sped destiny along.

Yes, I've been burned (likely everyone here has been once or twice)... 1984, my computer science midterm project --- pulled an all nighter to recode, and have never failed to make multiple backups since.

Disk heads don't always write on track and there are ways to recover this side data.

And that's exactly what this survey has shown to be wrong, at least for HDDs. The government security rules obviously still include the possibility, that someone is using floppy drives, there you need that.

---

Disk heads don't always write on track and there are ways to recover this side data.

And that's exactly what this survey has shown to be wrong, at least for HDDs. The government security rules obviously still include the possibility, that someone is using floppy drives, there you need that.

One of the drives I wrote a diagnostic program for had the ability to read off track. The function was included because the disk was removable and the heads might not match the alignment of another drive that used the pack. It's also possible for the head not to settle in exactly the same location because the direction it approached the track.

To get at this data you would need custom hardware or the disk would need to be removed and treated to make the data visible. You would only find these procedures at a place like the CIA or the FBI. The trick as always is to make the data more expensive to recover than it's worth. For most applications, one write will do it. For spy vs spy, extra caution is required. U.S. Department of Defense 5220-22-M calls for over writing 7 times so there is no need to get carried away with it.

---

7 times might be still reasonable in such special cases for to be sure, but not 100, like written above. And actually I don't understand, why in such cases the drives are not crypted.

---

Disk heads don't always write on track and there are ways to recover this side data.

And that's exactly what this survey has shown to be wrong, at least for HDDs. The government security rules obviously still include the possibility, that someone is using floppy drives, there you need that.

One of the drives I wrote a diagnostic program for had the ability to read off track. The function was included because the disk was removable and the heads might not match the alignment of another drive that used the pack. It's also possible for the head not to settle in exactly the same location because the direction it approached the track.

To get at this data you would need custom hardware or the disk would need to be removed and treated to make the data visible. You would only find these procedures at a place like the CIA or the FBI. The trick as always is to make the data more expensive to recover than it's worth. For most applications, one write will do it. For spy vs spy, extra caution is required. U.S. Department of Defense 5220-22-M calls for over writing 7 times so there is no need to get carried away with it.

Actually, current DoD and NSA policy is to degauss (with an NSA approved degausser), then shred drives.

http://www.oregon.gov/DAS/OP/docs/policy/state/107-009-005_Exhibit_B.pdf

But, I would agree that for most consumer use, bit-level writing 7 times would be sufficient for data destruction (although Gutmann's 35 pass would be even better :)).

---

Actually, current DoD and NSA policy is to degauss (with an NSA approved degausser), then shred drives.

http://www.oregon.gov/DAS/OP/docs/policy/state/107-009-005_Exhibit_B.pdf

According to this document they shred everything... even SDRAM... they really need a looong talk with some doctors.

---

Good luck on the recovery -- folks here are hoping for you.

Needless to say I won't be allowing the teenager near my HD again.

Apologies for pointing it out, but a $2 DVD/CD backup or two would have saved a lot of stress and anxiety. If the eggs are in ONE basket, then it's just a matter of time before the basket fails or is lost through other means (virus, theft, virus, fire, virus, lost or Xray zapped airline luggage from England, virus, etc). Sonny merely sped destiny along.

Yes, I've been burned (likely everyone here has been once or twice)... 1984, my computer science midterm project --- pulled an all nighter to recode, and have never failed to make multiple backups since.

I know, I know :(

I am usually a compulsive backer upper, but I recently emigrated to Canada with nothing but 4 suitcases and my whole life on that external HD. For various reasons I haven't been able to buy anything but a Netbook. I should have copied the vital stuff onto that, but I was waiting until I could get a new computer.

Hindsight is so clear. :(

I'll let you all know if I get my data back.

---

Reality Internet Personality

Actually, current DoD and NSA policy is to degauss (with an NSA approved degausser), then shred drives.

http://www.oregon.gov/DAS/OP/docs/policy/state/107-009-005_Exhibit_B.pdf

According to this document they shred everything... even SDRAM... they really need a looong talk with some doctors.

I would agree with that because the United States biggest government leaks have been caused by people working for the government for up to 30 years without being fully checked out. We lost military encryption codes, fleet information, state department secrets and agent information all due to people selling information on the side. They are far more worried about hardware than the real source of most of their leaks. One major leak was caused by a guy that was supposed to be looking for people who were leaking information but it was only in the end that he was suspected. A couple of documents are here and here but I suspect this list is not complete because some may still be undiscovered and others may be useful as double agents.

---

Good luck on the recovery -- folks here are hoping for you.

Needless to say I won't be allowing the teenager near my HD again.

Apologies for pointing it out, but a $2 DVD/CD backup or two would have saved a lot of stress and anxiety. If the eggs are in ONE basket, then it's just a matter of time before the basket fails or is lost through other means (virus, theft, virus, fire, virus, lost or Xray zapped airline luggage from England, virus, etc). Sonny merely sped destiny along.

Yes, I've been burned (likely everyone here has been once or twice)... 1984, my computer science midterm project --- pulled an all nighter to recode, and have never failed to make multiple backups since.

I know, I know :(

I am usually a compulsive backer upper, but I recently emigrated to Canada with nothing but 4 suitcases and my whole life on that external HD. For various reasons I haven't been able to buy anything but a Netbook. I should have copied the vital stuff onto that, but I was waiting until I could get a new computer.

Hindsight is so clear. :(

I'll let you all know if I get my data back.

Get a life has a whole different meaning for you. ; )

---

Hope u get the problem resolved Es. Once you've settled in more, why not protect your data even more...

Try one of these...Sumvision

I use them & so far, they've done pretty well.



The LH one has only 1 drive in atm... a 1.5tb

The RH one 2x 1tb.

---

I'll let you all know if I get my data back.

If we see one of those "Free to a good home...." ads posted for a teenager, we'll know things didn't go so well. I'll keep all crossable things crossed for ya, Es... keep the faith.


_________________
*** Backup? I don't need no stinkin' back -3=t40=-4$%lk

ERROR READING DRIVE C:

I'll let you all know if I get my data back.

If we see one of those "Free to a good home...." ads posted for a teenager, we'll know things didn't go so well. I'll keep all crossable things crossed for ya, Es... keep the faith.


_________________
*** Backup? I don't need no stinkin' back -3=t40=-4$%lk

ERROR READING DRIVE C:

I'll dress him up as a raccoon and send him to Angela.

---

Reality Internet Personality

Please - do not go Off-topic -
this thread is about how to Recover - Not how to destroy :)


@Es99:
You did not say - how big is this external HDD?
How many GB of (your valuable) data had been on it?
(
The data is still there (even if "standard" (not-quick) format is done on HDD) but not visible as files.
The format only reads all the sectors of the disk to make sure they are readable (not "bad" sectors)
and then overwrites the first 2-20 MB of the disk with empty root directory and FAT (mostly zero bytes).
)

When you last defragmented it? (do NOT do it now!)
Or is/was it full of data fresh-copied just before you "recently emigrated to Canada"?


Any recovery software will benefit if the files are on consecutive sectors on the disk.

The recovery software reads every sector (= 512 bytes) of the HDD
and searches for some identifiable strings (found at the beginning of the sector where the file starts/was before)
to recognize the file type (and that this sector is the starting point of a file)

e.g.
EXE, DLL, SYS, VXD, ... files start with "MZ"
RAR files start with "Rar!"
ZIP files start with "PK"
PNG files start with "‰PNG"
JPG files start with "......JFIF"
DOC files have "... Word ... Document ..." strings inside
etc. ...

Some files have info in the header for their length.

The best of all - if sub-folders are found (they start with "." and ".." entries)
http://en.wikipedia.org/wiki/File_Allocation_Table
http://en.wikipedia.org/wiki/File_Allocation_Table#Directory_table
http://en.wikipedia.org/wiki/NTFS

The sub-folders contain real filenames and pointers to the sector/cluster where the file starts
but the file AFAIK have to be in consecutive sectors/clusters to be recovered "to the end".
If the files are freshly-copied onto empty disk or the disk was recently defragmented (before the format)
the files are in consecutive sectors/clusters.

_________________________

You can experiment how good is some recovery software to do the job by USB flash drive ("stick"):

Check first you have NO valuable data on the USB stick!

* Format it to NTFS (if that was the file system of your HDD)
(Open "Computer", right-click on the USB drive (be carefull which drive you select!) and choose "Format...")
* Copy to it some full directory tree (folder with many sub-folders and different files in it)
* Use the icon (near the clock) to "secure remove the drive" (wait for the message "Now you can securely remove the drive")
* Remove the USB stick and insert it again

* Now - Quick-format it to FAT-32 (on USB stick you have to "Quick-format" - else all sectors are zeroed AFAIK).
Look at it - it will "pretend" to be empty

* Run the recovery software
(
e.g. Recuva
http://www.piriform.com/recuva/features

"Recovery from damaged or formatted disks
Even if you've formatted a drive so that it looks blank, Recuva can still find your files on it."

(I use CCleaner - it is good software so I trust PiriForm.
But I never used Recuva - you or your BF have to experiment
I did recovery (using Norton tools) but in the old DOS times 15 years ago)
)

* Try to recover the "extinct" files from the USB stick
* Check the recovered files
(by comparing them to originals (I use Total Commander),
or compress (WinRAR) the originals and the recovered and check they have the same CRC32
or by just opening the recovered files (not very secure method to verify))


Do this experimenting several times using different files to copy to USB stick
to become familiar and confident how to use particular recovery software
and to check what results you can expect.

Wish you successful recovery :)

_________________________

---

 


- ALF - "Find out what you don't do well ..... then don't do it!" :)
 

Good advice about practicing on a USB stick or junk drive first.

I've never had to recover data after reformatting, but I have done several several severely trashed unbootable/unreadable system disks. The software I use is GetDataBack by Runtime Software. It's not free, but $69 US for a lifetime licence that covers you for upgrade versions too is pretty good.

There's a free download, which will go through the motions of scanning the disk and showing you what's there: you just can't copy the recovered files anywhere useful if you haven't paid the money. Make sure you get the correct (I think you said FAT32?) version - they have a fifferent one for NTFS.

Please - do not go Off-topic -
this thread is about how to Recover - Not how to destroy :)


@Es99:
You did not say - how big is this external HDD?
How many GB of (your valuable) data had been on it?
(
The data is still there (even if "standard" (not-quick) format is done on HDD) but not visible as files.
The format only reads all the sectors of the disk to make sure they are readable (not "bad" sectors)
and then overwrites the first 2-20 MB of the disk with empty root directory and FAT (mostly zero bytes).
)

When you last defragmented it? (do NOT do it now!)
Or is/was it full of data fresh-copied just before you "recently emigrated to Canada"?


Any recovery software will benefit if the files are on consecutive sectors on the disk.

The recovery software reads every sector (= 512 bytes) of the HDD
and searches for some identifiable strings (found at the beginning of the sector where the file starts/was before)
to recognize the file type (and that this sector is the starting point of a file)

e.g.
EXE, DLL, SYS, VXD, ... files start with "MZ"
RAR files start with "Rar!"
ZIP files start with "PK"
PNG files start with "‰PNG"
JPG files start with "......JFIF"
DOC files have "... Word ... Document ..." strings inside
etc. ...

Some files have info in the header for their length.

The best of all - if sub-folders are found (they start with "." and ".." entries)
http://en.wikipedia.org/wiki/File_Allocation_Table
http://en.wikipedia.org/wiki/File_Allocation_Table#Directory_table
http://en.wikipedia.org/wiki/NTFS

The sub-folders contain real filenames and pointers to the sector/cluster where the file starts
but the file AFAIK have to be in consecutive sectors/clusters to be recovered "to the end".
If the files are freshly-copied onto empty disk or the disk was recently defragmented (before the format)
the files are in consecutive sectors/clusters.

_________________________

You can experiment how good is some recovery software to do the job by USB flash drive ("stick"):

Check first you have NO valuable data on the USB stick!

* Format it to NTFS (if that was the file system of your HDD)
(Open "Computer", right-click on the USB drive (be carefull which drive you select!) and choose "Format...")
* Copy to it some full directory tree (folder with many sub-folders and different files in it)
* Use the icon (near the clock) to "secure remove the drive" (wait for the message "Now you can securely remove the drive")
* Remove the USB stick and insert it again

* Now - Quick-format it to FAT-32 (on USB stick you have to "Quick-format" - else all sectors are zeroed AFAIK).
Look at it - it will "pretend" to be empty

* Run the recovery software
(
e.g. Recuva
http://www.piriform.com/recuva/features

"Recovery from damaged or formatted disks
Even if you've formatted a drive so that it looks blank, Recuva can still find your files on it."

(I use CCleaner - it is good software so I trust PiriForm.
But I never used Recuva - you or your BF have to experiment
I did recovery (using Norton tools) but in the old DOS times 15 years ago)
)

* Try to recover the "extinct" files from the USB stick
* Check the recovered files
(by comparing them to originals (I use Total Commander),
or compress (WinRAR) the originals and the recovered and check they have the same CRC32
or by just opening the recovered files (not very secure method to verify))


Do this experimenting several times using different files to copy to USB stick
to become familiar and confident how to use particular recovery software
and to check what results you can expect.

Wish you successful recovery :)

_________________________

Good advice there, I wish you (and your son) the best of luck.

---

Join TeamACC

Sometimes I think we are alone in the universe, and sometimes I think we are not. In either case the idea is quite staggering.

Please - do not go Off-topic -
this thread is about how to Recover - Not how to destroy :)


@Es99:
You did not say - how big is this external HDD?
How many GB of (your valuable) data had been on it?
(
The data is still there (even if "standard" (not-quick) format is done on HDD) but not visible as files.
The format only reads all the sectors of the disk to make sure they are readable (not "bad" sectors)
and then overwrites the first 2-20 MB of the disk with empty root directory and FAT (mostly zero bytes).
)

When you last defragmented it? (do NOT do it now!)
Or is/was it full of data fresh-copied just before you "recently emigrated to Canada"?


Any recovery software will benefit if the files are on consecutive sectors on the disk.

The recovery software reads every sector (= 512 bytes) of the HDD
and searches for some identifiable strings (found at the beginning of the sector where the file starts/was before)
to recognize the file type (and that this sector is the starting point of a file)

e.g.
EXE, DLL, SYS, VXD, ... files start with "MZ"
RAR files start with "Rar!"
ZIP files start with "PK"
PNG files start with "‰PNG"
JPG files start with "......JFIF"
DOC files have "... Word ... Document ..." strings inside
etc. ...

Some files have info in the header for their length.

The best of all - if sub-folders are found (they start with "." and ".." entries)
http://en.wikipedia.org/wiki/File_Allocation_Table
http://en.wikipedia.org/wiki/File_Allocation_Table#Directory_table
http://en.wikipedia.org/wiki/NTFS

The sub-folders contain real filenames and pointers to the sector/cluster where the file starts
but the file AFAIK have to be in consecutive sectors/clusters to be recovered "to the end".
If the files are freshly-copied onto empty disk or the disk was recently defragmented (before the format)
the files are in consecutive sectors/clusters.

_________________________

You can experiment how good is some recovery software to do the job by USB flash drive ("stick"):

Check first you have NO valuable data on the USB stick!

* Format it to NTFS (if that was the file system of your HDD)
(Open "Computer", right-click on the USB drive (be carefull which drive you select!) and choose "Format...")
* Copy to it some full directory tree (folder with many sub-folders and different files in it)
* Use the icon (near the clock) to "secure remove the drive" (wait for the message "Now you can securely remove the drive")
* Remove the USB stick and insert it again

* Now - Quick-format it to FAT-32 (on USB stick you have to "Quick-format" - else all sectors are zeroed AFAIK).
Look at it - it will "pretend" to be empty

* Run the recovery software
(
e.g. Recuva
http://www.piriform.com/recuva/features

"Recovery from damaged or formatted disks
Even if you've formatted a drive so that it looks blank, Recuva can still find your files on it."

(I use CCleaner - it is good software so I trust PiriForm.
But I never used Recuva - you or your BF have to experiment
I did recovery (using Norton tools) but in the old DOS times 15 years ago)
)

* Try to recover the "extinct" files from the USB stick
* Check the recovered files
(by comparing them to originals (I use Total Commander),
or compress (WinRAR) the originals and the recovered and check they have the same CRC32
or by just opening the recovered files (not very secure method to verify))


Do this experimenting several times using different files to copy to USB stick
to become familiar and confident how to use particular recovery software
and to check what results you can expect.

Wish you successful recovery :)

_________________________

The drive was not recently defragmented before I loaded it up. I had a few things on there before I copied a whole lot more over just before I moved.
It is a 180G portable drive, but I don't think I had used even half of that.

A lot of the files (and the ones I really want back) are teaching resource disks that were full of 1000s of valuable worksheets, games, teaching videos etc. Stuff that I have accumulated over 8 years of teaching and that would cost $1000s to replace.

The BF claims to have successfully recovered the contents of HDs before using this software. I will point him towards everyone's advice in this thread before I allow him to proceed! It would be a shame if I had to disguise both him and the teenager as raccoons and rehome them both in Eric's garden.

---

Reality Internet Personality

I recently emigrated to Canada

Welcome to Canada! My sincere hopes that we get to hear you are back in action, fully recovered, and making excellent use of everything!

Regards,

---

The drive was not recently defragmented before I loaded it up. I had a few things on there before I copied a whole lot more over just before I moved.
It is a 180G portable drive, but I don't think I had used even half of that.

Sounds good - you can expect 90% of the files to be not-fragmented (good for recovery)

I do not know how Xbox formats the disks -
it is important to check (before the recovery) that now the "empty" FAT32 disk
looks as having size ~180 GB (and not something like 32 GB)
(In this case (to see the full disk size) new partitioning may be required (made by experienced person who knows/is informed that the data on the disk have to be preserved for further recovery))

A lot of the files (and the ones I really want back) are teaching resource disks that were full of 1000s of valuable worksheets, games, teaching videos etc. Stuff that I have accumulated over 8 years of teaching and that would cost $1000s to replace.

"teaching resource disks":
What do you mean - .iso files? (or similar CD/DVD images)
If such (BIG - 700MB - 4.5GB) file is successfully recovered it will contain all the files/folders (found on the originating CD/DVD) with their original names and contents (very good).
(If you are using Alcohol 120% or DAEMON Tools to mount the images from this portable disk (to see them as new drive letters, e.g. F: G: H:) there are CD/DVD images (.iso, .cue/.bin, .mds/.mdf, .nrg, ...) to be recovered)

But if you just copied the contents of the CD/DVD as "normal" files:
Video files can be recovered (.avi begin with "RIFF....AVI", .swf begin with "CWS" - so deep scan can find the files)
Worksheets - if you mean .xls they can be found (begin with bytes "D0 CF 11 E0")
(almost every file type has some signature in the beginning (header))

Games may be hard to recover (if they consist of many files) - they depend on exact filenames and folder tree structure (as any complex program).
(But if "game" means just one .exe setup/install file per game it is OK for recover)

Use "Deep scan" (will take long but will scan all sectors (all 180 GB) and find all that can be found):
http://docs.piriform.com/recuva/technical-information/how-recuva-works

Expect that some of the files will not have the names you know but be named e.g.:
file0001.doc
file0002.exe
file0003.jpg
file0004.avi

The BF claims to have successfully recovered the contents of HDs before using this software. I will point him towards everyone's advice in this thread before I allow him to proceed! It would be a shame if I had to disguise both him and the teenager as raccoons and rehome them both in Eric's garden.

"using this software":
What software?

"claims to have successfully recovered ...":
"Torture" him to pass the "USB stick test" -

You do the steps from "* Format it to NTFS" to "* Now - Quick-format it to FAT-32".

Then give him the "empty" USB stick (looking at the contents you have to see no files).

Ask him to show you (in front of your eyes) how he recovers the files from the USB stick.

You will learn:
- is he good enough (in recovery - not in bed ;) )
- how the recovery is done
- what you can expect - are the files with the same names, in the same folders and the same contents
(I would expect some 10-20% to be in the root directory (or directory named e.g. "Recovered Files") with "generic" names like "Recovered_File_00001.xls")
- how long it takes
(it can be many hours (for the HDD with 1000s of files) so if he is successful make him a good dinner (I can hear him asking for something after the dinner ... ;) ))

You have to invest some time (hours, even days) to learn, understand and experiment.

Good luck

.

---

 


- ALF - "Find out what you don't do well ..... then don't do it!" :)
 

Here's a suggestion to help you:

http://www.ontrackdatarecovery.com/

Not sure of your current financial situation, but I have used this company once or twice before, one time because of a Ghost going horribly wrong.. Got 65-75% of the data back. They are very very good, but not inexpensive. It just depends on how valuable your data is to you. For me, ususally if it's that important, I back it up to a few DVD's, otherwise I kick myself and move on. Good thing is it's very rare nowadays, at least for me, knock on wood. MTBF seems to have improved over the years. Back on topic, I am fortunate enough to live 3 miles from their facility, so I hand delivered the drives, and worked out a little discount, though this was years ago, before being bought by Kroll. Still very highly rated though. If you are considering going down this route, don't let Anyone do Anything to the drive, for the best chance of getting as much data as possible off of it. Hope this helps.

---

Hope u get the problem resolved Es. Once you've settled in more, why not protect your data even more...

Try one of these...Sumvision

I use them & so far, they've done pretty well.



The LH one has only 1 drive in atm... a 1.5tb

The RH one 2x 1tb.

This I just gotta share. I was interested in Sirius B's post as I have been looking for good value in a network aware storage solution for the home LAN.

I click on the link.

I get the following:

Forbidden
You don't have permission to access /Sumvision-TB32-Dual-Bay-3.5-2xSATA-HDD-Raid-Enclosure-USB2.0-SATA-E-SATA-JBOD-Cooling-Fan-Retail.html on this server.

Additionally, a 403 Forbidden error was encountered while trying to use an ErrorDocument to handle the request.

YIKES! Like sorry eh?! Didn't mean to pry!

I especially like getting the 403 Forbidden error while the ErrorDocument was trying to handle the error. I'm forbidden from even knowing that I am forbidden I think!

Good scotch was almost wasted as screen cleaner.

Regards,

---