Stupid People Should Not Perform Recoveries !!!!

At work one of my colleagues (Who must pray he never has to ask for a reference) accidentally deleted the entire contents of someones

"c:\documents and settings\Username\my documents folder."

He then performed a recovery with some sub standard piece of nonsense to, ......... Yes , you guessed it the original file location over writing any chance I had to perform a proper recovery.

Now we have 16000 files with cluster******.*** as the file names.

The extensions are incorrect as are the file names.

1. I am open to suggestion on other recovery methods for the original directory although even the mighty on-track suite doesn't see it as a deleted dir.

2. Any idea of any program that will auto associate the files correctly ?

3. Anyone prepared to kill this employee would be greatly rewarded.

You dont have a tape backup??

delete contents and restore from backup...

MLF

winternals admin pack can restore lost clusters.

As for stupid, I have done that before and I once cloned an entire critical hard drive in reverse. Meaning I wrote over the good drive with a blank one. Live and learn. ;)

last time I had to restore deleted files it was from a USB drive and went well except that the software I had could only do one file at once.

Restore this
Save it here
Restore this
Save it here
*zzzzzzzzzzzzzzz*

Give me a photo and £20 and I will be there though. For the good of techs everywhere :P

Most text based documents should open ok in word pad so you can at least reconstruct the contents, even in cluster sized chunks.

Hey Mark,

Quote:

---

"c:\documents and settings\Username\my documents folder."

---

Is that a local drive? :eek:

What exactly do you do for backups?............... I am afraid that I don't quite figure your setup there?

If it is a local drive, then I would make sure that I have a secondary/slave drive of equal size or greater.

This software is what I use from time to time. You are pretty desperate to have to use it, but it works. ;)

Basically it just looks at the drive and tries to re-assemble any file fragments that it finds, or whole files. it doesn't care about applications and operating systems as such, but there are Billy Windoze and Linux versions of it.

http://www.roadkil.net/unstopcp.html


I think that you guys need a recovery procedure documented, and invest in a couple of external HDDs perhaps?

Quote:

---

3. Anyone prepared to kill this employee would be greatly rewarded.

---

I charge per kilo of body weight............... perhaps he needs a formal re-christening to "Alfredo"?

As in "Breeng me ze 'ead of Alfredo Garcia" elkgrin

Quote:

---

delete contents and restore from backup...

---

I think that is not what I would go for........... I would restore first to a new location and check that it worked. I guess I would have a bad feeling in general about an environment where something like this had happened.

Good luck..................

Quote:

---

Originally Posted by RoadClosed

As for stupid, I have done that before and I once cloned an entire critical hard drive in reverse. Meaning I wrote over the good drive with a blank one. Live and learn. ;)

---

I did the same thing - but only once. Fortunately, it wasn't so critical! Now I ALWAYS use FDISK on the receiving hard drive to delete the partitions. That way, Ghost can't do anything but copy in the correct direction.

Quote:

---

Originally Posted by mark_boyle2002

3. Anyone prepared to kill this employee would be greatly rewarded.

---

Before you undertake this third step, make sure you have a biohazard-rated dumpster. OSHA & the EPA will nail you for improperly disposed of body parts. :)

for a free program you can use http://www.smartpctools.com/data_recovery/index1.html

Sounds like this belongs in the Dumb User thread :)

http://antionline.com/showthread.php?t=275215

Hmmmm,

Stupid is as stupid does?

Quote:

---

Now we have 16000 files with cluster******.*** as the file names.

---

And nary a backup in sight :eek:

Haha Moria. Merge the threads!

This is actually a serious forensics question, even though the circumstances might belong in a humour thread. It's just Mark's posting style, and you obviously don't know him like I do. :D

A lot depends on how the original deletion was carried out and how the recovery tool tries to work.

If a proper deletion tool was used it will have deleted the file names, overwritten the files and overwritten the cluster nodes and slack space. You will recover nothing :(

If it was a straightforwards Windows deletion then you should be able to recover it, as the file names and content should still be there. Only the index of files has been removed and the filespace has been allocated as available. That is why you should not use the drive until you have completed the recovery, as you will overwrite the data.

The tool I suggested was Roadkil's "Unstoppable Copier". It does what it says on the box, even for screwed up and damaged HDDs. It won't work for drives that won't spin, you need to use other techniques there.

What it gives you is a reconstituted picture of every file and partially recoverable file on the drive. It works for Windows and Linux.

What worries me is the file names "XXXXXXXX.XXX". Now, if that is just the index, then the file names may still be there?. I can understand On-Track (which is a forensics tool rather than a data recovery one) not spotting it, as Windows will recreate the directory when you reboot it AFAIK.

The tool that was used to attempt the recovery should not have done what it did. Or, at least it should have asked the user if they wanted to replace the existing files.

oofki I'm not a moderator or I might :D

I didnt realize that nihil, I didn't take the thread as a challenge. I guess because there was no direct question asked...

Well oofki,

If we set aside Mark's Glaswegian (largest city in Scotland) sense of humour we have:

Quote:

---

Now we have 16000 files with cluster******.*** as the file names.

The extensions are incorrect as are the file names.

1. I am open to suggestion on other recovery methods for the original directory although even the mighty on-track suite doesn't see it as a deleted dir.

2. Any idea of any program that will auto associate the files correctly ?

---

Which is certainly a challenge if not "mission impossible" :D

I guess we would have to know more?

1. What sort of filenames are they and are they unique?
2. What are the current file extensions?
3. What are the applications that should open them?
4. Are they of a consistent format by file/document type?
5. Are they organised into directory groups (folders) and have these been preserved, and are they correct.

You see, recovering the file contents (if this is indeed possible) is only part of the battle if there are 16,000 of them. That would still leave the enormous task of correctly re-naming them, titling them and referencing them?

16,000 is one hell of a lot of documents for one guy, so I guess they must be small and be something like forms, e-mails or the like? I would also guess that the person has to be very much an offsite worker?........... after all why else have that many on your individual PC.

This may give us some hope, as an external worker would normally synchronise their laptop with a server when they call into the office. That bit should at least be backed up somewhere on site?

If we can recover the individual records and they do follow a strict format, then we could write a utility to read them and recreate the missing/corrupted data.

This is actually not that much of a biggie. Not so long ago, the Alaska State Government had to pay around $250,000 to have some 600,000 records re-entered from paper copies due to a similar sort of foul up ;)

nihil, its not 16,000 documents its 16,000 document fragments that need to be stitched back together.

note the file name "cluster" so, it might be that 100 of these make up one file.

If that is the case then "unstoppable copier" should do the job if the clusters are still cross-related. ;)

Hi,

I am no Expert here and have not gone through any serious forensic investigation of lost data. However I think I know some of the basics. So I am sorry for providing no solutions. However I have got a question:

Nihil said that the data is recoverable if all the clustes are cross related. Well, I am not sure but I think this is what the statement means:

Since the data is spread over the hard disk in fragments (in most of the cases), the files whioch actually act like a liner set of bytes split into smaller data units more like a linked list are spread all over the disk (randomly). This makes the pointer of each unit to point to the next cluster where the next chunk of data from the same file resides on the disk.

Is this what is meant by cross related?

One more question: I am not sure about the I/O faculty of the different OSes on earth but is there a chance that an OS will prefer to split a 10 MB file into small chuncks and place them in the GAPS created by deletion of files thus frangmenting the 10 MB file or should it prefer to place it on the disk where the 10 MB of space is free in series so that the file remains contiguous.