Sunday, February 17, 2008

DATA RECOVERY FROM HD crash AND UNDELETION

If you've been using computers for a decent amount of time there is a good chance someone has told you that data stored on a hard drive is not exactly safe. I'm here to assure you that this is indeed true.

Never mind the fact that unlike tapes or CDs or other methods of storage, hard drives are mechanical, active devices and are thus subject to comparatively rapid breakdown.

No, the real threat to hard drives are the people that use them, by which I mean you and me. Hard drives, being the dynamic storage devices that they are, are extremely easy to erase in any number of amusing and simple to achieve ways... as are USB hard drives and flash memory cards

STEPS TO RECOVERY:

The number one rule to follow when you have lost data is to not write anything more to the affected hard drive! This rule stands true for any situation...

If you have deleted a partition by accident, do not create another partition, just leave it blank.

If you have deleted files from the recycling bin that you realize you need, do not (if possible) save anything to the drive. The reason for this is that hard drives do not actually erase anything, not data or partitions. When you erase a file from the operating system, it is just marked on the drive as having been deleted. When the system needs to store more data on the drive, it will consider files on the drive marked 'deleted' as being empty space, and cheerfully copy over them. If that happens then you're in big trouble.

The same rule applies twice over for partitions; since partition information just presents the operating system with a way of addressing the space available on the drive. If you wipe out a partition everything from it will seem to be gone.

So if there is no partition information, no data can be read by the operating system. This does not mean that your data it is not there however, only that you can't see it. Data-recovery programs have no such handicap.

The first, and best thing to do in a data-loss situation is to make sure no more data is written to the drive. Obviously, if you have just the one partition and it's fried, you can't boot normally to the operating system. The best option in this situation is to transfer the drive to another computer, preferably one using the same file-system as your damaged partition (i.e. the same operating system, or a newer version).

Transferring the HDD to another computer has the dual benefit of preventing the drive from being written to accidentally, and potentially allowing you to retrieve information from the disk just by using Windows Explorer to look through file structures.

If you have damaged or erased essential operating system files, but the partition information is still intact Windows will not boot. The HDD can still be read from a different operating system which is one way out of the doom and gloom.

FILE RECOVERY PROGRAMS:

If you do not have the means to physically transfer the hard disk, resist the temptation to re-install your OS. There are several software tools available which will enable you to boot your computer with an alternative operating system and then help you try to recover the files.

The simplest way to gain access to the files on your hard drive with a toasted OS is boot your computer with a DOS boot disk and then use a DOS compatible file recovery program such as Testdisk http://www.cgsecurity.org/wiki/TestDisk_Download

There are several programs such as 'Winternals Disk Commander' and 'ERD Commander', that will boot your system straight into DOS or an alternate OS, then perform file recovery. None of these programs are free however.

FREEWARE:

If there is one problem with the area of data recovery software, it's that companies know that a functional recovery program is something that people will pay good money for. Hence freeware and non-crippled shareware programs are thin on the ground.

There are a few options available though, so on with the list. Please read these through carefully before deciding the next step you will take.

FINDNTFS http://www.partitionsupport.com/utilities.htm

NTFS reader for DOS http://www.ntfs.com/products.htm

Undeleting Files in Windows XP ( COMMERCIAL RECOVERY TOOLS)

http://www.r-tt.com

http://www.file-rescue.com

http://www.symantic.com

http://savemyfiles.com/fastfile.htm

http://www.winternals.com/products/repairandrecovery/filerestore.asp


No comments: