write an "unformat" program

[vb.elmar]

Hello,

if i wanted
to recover data destroyed by the dos command
"format C:", could i use an api-function
that can scan clusters, collecting data
and recover some single files
(and not be based on information in the
directory structure)??

[Q_Me]

You can not recover anything unless you did a "Quick" format on the drive other than that all data is lost.

[INF3RN0666]

WOW i think you're getting to deep for VB! What you need is a drilling rig like C++, while you're trying to use a shovel! It can barely have a system wide keyboard hook. Well i'm not sure actual but it sounds impossible for VB.

[INF3RN0666]

what ever Q_Me said is a lie. No offense Q_Me but it's wrong. I've done recoveries after I partitioned the drive. I'm dead serious. I wasted my 4.3 gig old harddrive accidentaly by partitioning the wrong drive letter because it magically changes in the fdisk program. so I found some weird ass program that can recover partitions. I coulda recovered things from like 3 partitions ago! Obviously it ****s up the directory structure, but atleast it got the files back! I aint redownloading all that music :P. Yeah but it worked and it was great. If you wanna clear the hard drive of all evidence, u need a factory erase. that's like whiping off a whole layer of the harddrive and can possible bust it.

[Negative0]

INF is right, the data is still on the hard drive until it is overwritten. There is software out there that does "real deletes" by deleting the file from the HD and then writing data multiple times where the file used to be. This gets rid of the file information.

As for VB recovering the data.... I think you need to use a language that is closer to the system such as C++ or even ASM.


Good luck,

[DiGiTaIErRoR]

Originally posted by INF3RN0666
what ever Q_Me said is a lie. No offense Q_Me but it's wrong. I've done recoveries after I partitioned the drive. I'm dead serious. I wasted my 4.3 gig old harddrive accidentaly by partitioning the wrong drive letter because it magically changes in the fdisk program. so I found some weird ass program that can recover partitions. I coulda recovered things from like 3 partitions ago! Obviously it ****s up the directory structure, but atleast it got the files back! I aint redownloading all that music :P. Yeah but it worked and it was great. If you wanna clear the hard drive of all evidence, u need a factory erase. that's like whiping off a whole layer of the harddrive and can possible bust it.

They can only be recovered accurately if nothing has been written over what was there.

If you write random data over the file, then delete it, it's highly unlikely to recover the original data.

[BuggyProgrammer]

Originally posted by DiGiTaIErRoR
They can only be recovered accurately if nothing has been written over what was there.

If you write random data over the file, then delete it, it's highly unlikely to recover the original data.

not with just recover software. specialists have special equipment to scan really deep into the data, and recover it. i don't know how they do it, but you can search on it.

[vb.elmar]

Hi

yes it was a kind of quick format.

i used ghost to bring a new windows98 system on my
HD and i recovered many data with "lost & found"
but i could not recover the 35 bitmaps
(path : D:\cap\Cap_0001.bmp - D:\cap\Cap_0035.bmp)
i wrote one day before. Each file was 324kB

it would be interesting to write a vb program
to feed 30 filenames into a textbox, and getting
the clusters from the path.

then i can estimate the clusters where the remaining
5 files must be (for testing purposes).

in a program like lost & found i can make a
recovery in a small time when i know the clusters
where the files reside,
because i must not scan **all** the 28 GB
of the HD!

do you think that is possible to get the
clusters from a existing (non-deleted) pathname
with vb (a pathname like D:\cap\Cap_0035.bmp)??