Hard drive data recovery

I have a friend who is a photographer and had a bunch of pictures on his hard drive that he didn't have backed up. He got a boot sector virus. He has Windows XP restored the system to the "last known good". If he had talked to me before I would have got all the pictures off of the hard drive by making it a slave on another computer before trying anything like that. Anyways he lost all of his photos. So what I'm wondering is if they are really all gone or is there some chance of being able to recover the files. I've heard of criminal investigators who can recover supposedly recover deleted files from people's hard drives and wondered if that was really possible and what I could read to learn such things. Does anyone here know about this?

It is possible, assuming of course that the parts of the hard-drive containing the photos hasn't been re-used.

"All" you need to get the data back is the right software/equipment, but that can be hard to get hold of and very expensive. Your best bet would be to send the drive to a company which specialises in data recovery, and let them do it.

Yeah, I was thinking that might be the case. I'll have to find a good one I guess.

A recovery service is going to cost you quite a bit ($2000+ probably).
Are you sure the recovery formatted the drive? I'd check under documents and settings incase it just made a new profile.

well try this link http://www.undelete.com/file-recovery.asp and as mentioned before, these are very costly.

File Restore is only $39 and it works quite well.

http://www.winternals.com/Products/FileRestore/

Thanks guys for all the suggestions. I did check out his hard drive and it was reformatted. He's gotten quotes from local recovery services of about $200, but he probably can't afford that even. Maybe I should get File Restore. He's hard drive is an SATA and my hard drive is an IDE. Is it possible to make the SATA hard drive a slave drive on my computer? The only way I know how to make a master and slave hard drive is using cable select with two IDE hard drives.

I think you'll need a SATA controller card to do that. I'm not sure if that filerestore will work for a fromatted drive, I'd check with their tech support before you buy it.

how many hard drives does the computer have at the minute, for if you have 2 or more there is quite a good program that i have which i recommend...

Hi Jeebob,
I've got a similar problem - 2 HD's in machine though - would you tell me about the program please?
Thanks.

PS when I use original XP disk to do recovery get to DOS prompt - logging in as admin - but when I try to change dir to docs and settings it says permission denied (Admin user?!?!). I planned to copy the photos and docs from DOS!

Any tips on this would be great - please!!

Quote:

---

Originally Posted by Harsh Gupta

well try this link http://www.undelete.com/file-recovery.asp and as mentioned before, these are very costly.

---

Thanks for this link. It is very usefull to me.

Thanks,
sounds promising (and worthwhile to have anyway). My problem is that I cannot boot into XP so I would not be able to use this unless I changed round disks and installed XP onto other one. In these situations I would like to try anything which required least twiddling around first, for fear of making things worse, if there is some other option.

Any ideas as to why I don't have permission to access that folder as admin unser?
Ta

Okjas ,did your friend format his HDD. or did the partition's just vanish away.If its the second case,then you can try filescavenger from www.quetek.com/filescav/faq.htm

My 160 gb SATA Hdd has crashed twice before but i was able to recover them using filescav.So just give it a try .

If your friend had enabled encrypt data option then other users cannot read the contents as they would be encrypted but if its showing access denied then you can change the ownership to regain access.

the program i use is ontrack easy recovery (professional) quite simple to use and quite effective...

also if you need to change the access rights, you do need windows XP Pro if you have home edition you wont be able to change the rights as easily, in fact i dont think you can change them at all on xp home...

but to do so on xp pro

go to Tools, Folder Options, View, and near the bottom is "use simple file sharing", untick that box and apply changes.

then go to the folder your trying to access, right click and go to properties, click on security, and under advanced set all the permissions to the windows account you are logged onto. for example, if you are logged in as Administrator, you need to set the access rights to (yourpcname)\Administrator. windows is too picky and is case sensitive... please come bac to us and tell me if this works for yourself :thumb: good luck

Provided the partition is in NTFS

true... although i have never tried it with fat, not sure how much more different or impossible it is on fat...

You dont get that security tab on a fat32 partition

ahhh right, that explains that then! :thumb:

The main thing everyone needs to remember about hard drive recovery is, NEVER DO ANYTHING AT ALL on the damaged hard drive!!! Don't even boot to it! Immediately shutdown (use the power button for 3 seconds, not a full shutdown). Hook it up as a slave to another hard drive and run some recovery software! I've made this mistake and accidentaly lots about half of some of the photos I was trying to recover, luckily, they weren't important ones! And NEVER EVER try to use recovery software form the damaged drive, every and any file you add or change on that hard drive is another chance part of your stuff was written over! I used something like ZAR pro I think. I had a few problems with it, but in the end it worked.

If I put it into another machine (XP Pro) as a slave drive will that machine have priviledges to read the content? Will I need to do anything to give me those access rights?

Well If you cant then you need to take over the ownership of the files and folders.

Sorry if being a bit thick - how would I do that?
(this is a home PC so I will not have access to many things when I attempt this - including the internet).

Thanks.

Make sure that partition is in NTFS(Which you can find out from my computer).Then right click the folder>properties>security>advanced>ownership .Here replace the existing owner with the admin acc on your system.You can also check the "Replace owner and sub container objects" to take over any sub folders(files) that exist.If still problem persists, just enable full rights for your admin in the main security tab.

I you cant see the securtiy tab ,goto tools>folder options>view>uncheck simple file sharing

Just a note:

I use PC INSPECTOR™ File Recovery. It recovers deleted data by reading 2nd FAT entry.

... And it is FREE. :D

also just for reference, if you need to convert the file format from fat to ntfs ...
go to start, run, type "cmd" then

"convert (drive letter): /fs:ntfs"

i.e.

"C: /fs:ntfs"

Quote:

---

Originally Posted by jeebob

"convert (drive letter): /fs:ntfs"

---

That uses "unused" disk space - the space your missing files reside in. It's a pretty good way to ensure that you won't be able to recover them.

Quote:

---

Originally Posted by Al42

That uses "unused" disk space - the space your missing files reside in. It's a pretty good way to ensure that you won't be able to recover them.

---

OK so the new advice.... dont convert to ntfs by that method...

I know i managed to get away with it, but I dont think I'l be doing it that way again, doesnt really affect me now anyway im all NTFS... glad you mentioned that!!