|
13 May 04 - 12:06 PM (#1184819) Subject: Tech: Are dumped files really gone forever? From: katlaughing For some reason, so far unfathomable, Roger deleted almost everything from our old hard-drive before I was able to transfer it to the new one. I think it was probably due to stress of doing computer troubleshooting all day at work, then coming home trying to solve our problems with this, too. I had my writings backed up, as well as my pictures, so thank goodness that's not a problem. BUT, I kept all of my old email files, as storage of things I wanted to keep, in both OE and Eudora, both of which seem to be completley dumped. These contained not only emails from and to my deceased mother, but also a lot of back and forth of genealogy information over five years. So...are they truly lost or is there a way in which I might find them in plain English please? I have tried to start OE and got told it couldn't start because the MSOE.DLL couldn't be loaded. I saw an article online which said I'd have to rename the Program file and reinstall WIN98 in order to correct that, but as far as I know we always only had WIN95 on the old one. I also am not sure the files would be there even if I did get OE open. I've done a c:/dir to see if I could find files listed that way, but it showed nothing. Do I give up and take it into a professional? Thanks, kat |
|
13 May 04 - 12:09 PM (#1184826) Subject: RE: Tech: Are dumped files really gone forever? From: GUEST it's possible the files could be recovered - through norton Disk Doctor or something similar - other then that - specialists and a LOT of money.would be required |
|
13 May 04 - 12:23 PM (#1184840) Subject: RE: Tech: Are dumped files really gone forever? From: Amos Take the hard disk out and take it to a specialist in data recovery. This problem is beyond the scope of an average user, in my opinion. You can try using Norton's recover utility to see what it can come up with but I haven't had a lot of luck with it. The data is PROBABLY still on the hard disk at least for a high percentage of those files but how much they can be reconstructed depends on which parts got erased. If it is just the file-allocation table (the map in the front of the book, so to speak) then the chances are good the data can be recovered. If the disk was highly fragmented before the erasure, it makes recoonstruction more complicated. Good luck, and hope this helps. A |
|
13 May 04 - 12:30 PM (#1184844) Subject: RE: Tech: Are dumped files really gone forever? From: mooman Generally, the digital "address tag" of the files is deleted but the files themselves remain until overwritten so there is a chance the material could be recovered. I would tend to agree with Amos. Norton may work but a specialist in this might get better results. Peace moo |
|
13 May 04 - 01:28 PM (#1184891) Subject: RE: Tech: Are dumped files really gone forever? From: JohnInKansas Important!!!!! If you intend to try to recover deleted files DO NOT WRITE ANYTHING to the disk until you have fully investigated your recovery options. When a file is deleted, only the first character of the file name is deleted. (Changed to a zero byte). As long as the rest of the file isn't moved or overwritten, one of the Norton or other recovery utilities should be able to recover it. In your case you DON'T want to install even the recovery program to the drive you're trying to save. Once something else has been written to the cluster(s) where the file was, it's gone. Most recovery utilities will run from a floppy. If you install - or reinstall - ANYTHING on the drive, you risk writing over files, since an empty byte at the first character of the cluster means it's "empty" and new stuff can be written there. If anything is in the "trash bin" you can select and recover. Even if it's been deleted from the trash bin, a good utility should be able to recover nearly anything on the disk that hasn't been overwritten. If your email was still in "email format" it probably is all in a single file, or at most a few files. Nearly all email programs use a database format for messages - they are all in ONE database, or at most one database per folder. For Outlook Express, it will be .dbx; but if you're using another email program you should check what the file extension you're looking for is, before going too far. If necessary, find another machine to make "Norton Recovery Disks" or "Norton Emergency Disks" (nomenclature varies with versions) on one or more floppies to use on your machine and run the recovery utility from floppy disk(s). Newer versions may allow you to run a recovery direct from the install CD, but I haven't used one that way. Note that we are talking Norton Utilities of one form or another - not just Norton AV. John |
|
13 May 04 - 01:36 PM (#1184895) Subject: RE: Tech: Are dumped files really gone forever? From: Bill D it simply depends on exactly what was done... look at this search Norton does have an un-erase program, but there are also dedicated programs for this sort of thing. Some reading 'might' get them back and save you some money. 'Usually' (if I understand it correctly) what happens is that the first few characters of the file name are overwritten, thus marking that space as available. If nothing else has been done, the file will still be there. There are programs which go looking for files with the first few spots marked that way, and offer you the chance to re-name them as 'real'. It can mean some tedious time spent deciding what the name was or should be, but I had to do this once, quite a long time ago, and it did work. |
|
13 May 04 - 01:39 PM (#1184898) Subject: RE: Tech: Are dumped files really gone forever? From: Bill D I shoulda known that other Kansas boy would be around...he posted while I was still typing..*grin*... (still...take a look at that Google gropus search) |
|
13 May 04 - 04:42 PM (#1185045) Subject: RE: Tech: Are dumped files really gone forever? From: katlaughing Thank you, thank you. I've found a recovery program at one of your links, BillD, and will try it as soon as I can figure out how to make it run from the cd I downloaded it to...its install wizard wants to put it on the c drive. John, thanks for the warning and explanation. I didn't know the first letter of a file name would be dropped like that and that the space could be used up by adding more programs, etc.! Hopefully, we have avoided that, to my knowledge. Thanks, again, guys. Great as always, kat |
|
13 May 04 - 06:24 PM (#1185119) Subject: RE: Tech: Are dumped files really gone forever? From: Liz the Squeak Not if the FBI are looking for you..... those guys could find an angels' fart in a volcano. LTS |
|
13 May 04 - 06:28 PM (#1185127) Subject: RE: Tech: Are dumped files really gone forever? From: GUEST Thank you for a really useful contribution to the discussion, Liz. So useful. Profound, even. |
|
13 May 04 - 06:38 PM (#1185140) Subject: RE: Tech: Are dumped files really gone forever? From: TheBigPinkLad If you're in North America there's a (kinda) franchise called PC Paramedics who will perform such tasks for you kat. In my town they're two geeks who look about twelve but boy are they good. They're reasonably cheap (I paid CDN$50) and ... are you sitting down ... they come to your house! |
|
14 May 04 - 12:32 AM (#1185354) Subject: RE: Tech: Are dumped files really gone forever? From: GUEST,.gargoyle Don't be so cheap - or lazy Kat.....and most of all don't try to pass the buck to Roger....if its your "imporatant information" treat it like it is important.
Purchase Norton Disk Doctor / Norton Utilities and learn how to use it.
You may be missing pieces....but you can recover gazzoodles......you can find "raw-data" since its first format.
Sincerely, |
|
14 May 04 - 01:55 AM (#1185377) Subject: RE: Tech: Are dumped files really gone forever? From: JohnInKansas Kat - Chances for recovery depend a lot on what drive format you were using. If your drive was a Win2K or WinXP drive formatted as an NTFS volume, your chance of recovering anything without going to a recovery service, i.e. a professional, are very low. If your drive was formatted as a FAT or FAT32 drive, the utilities may get quite a lot back if it hasn't been overwritten.. Norton knowledge base has an article: Chances for a successful recovery of deleted files and folders, that may give you a better idea of what is possible for your situation. John |
|
14 May 04 - 08:59 AM (#1185625) Subject: RE: Tech: Are dumped files really gone forever? From: Cheap Tracks "If your drive was a Win2K or WinXP drive formatted as an NTFS volume, your chance of recovering anything without going to a recovery service, i.e. a professional, are very low." I would disagree with that statement - I have had very good success on a couple of occasions recovering data from disks - once from a damaged disk, once from a formatted disk - both times NTFS. I have used a program called File Scavenger http://www.quetek.com/prod02.htm It's only $40 - you can download the demo and see if it finds stuff before you spend any money on the full version that can actually do the recovery. Saved my butt when I had a partition go away due to a failing drive. Take your "lost" disk and install it in your new computer. Install the recovery software on your new computer and when you run it save the recovered files to the main disk in your new computer. Per the advice already stated - DON'T WRITE ANYTHING to the disk you are trying to recover data from. Good Luck! karl Cheap Tracks |
|
14 May 04 - 09:23 AM (#1185641) Subject: RE: Tech: Are dumped files really gone forever? From: Rapparee Data can be recovered which has been overwritten several times. Data can even be recovered from disks that have been broken. In fact, the only way I know of to absolutely, permanently destroy data would be to physically melt the hard drive or disks into a pile of slag. I understand that the hard drives from the computers that were in the basement of the WTC on Sept. 11, 2001 were recovered and taken to Switzerland for data restoration. BUT such recovery isn't fast, cheap, or easy. Especially not cheap. LtS is correct: the FBI (or other governmental agency) could probably recover data from 'most any intact disk IF it were worthwhile to do so. Backup, backup, backup! |
|
14 May 04 - 09:37 AM (#1185648) Subject: RE: Tech: Are dumped files really gone forever? From: JohnInKansas Cheap Tracks - I haven't had the need to use any recovery utilities since adding a couple of NTSF drives. The advice above is quoted from the Norton page that was linked. There is additional info there. When a file is deleted, only a few "marker" bytes are actually rewritten. If you can put the markers back, recovery is possible, and the utilities available make it pretty easy - where there's anything to recover. Of course, if it's on your root disk, just running the machine writes temp files all over the place, so you're likely to get some overwrites, especially if the disk is pretty well filed and your assigned temp space is small. NTFS does have a more complex "indexing" structure, so if you get into having to reassemble clusters it takes pretty specific knowledge - and it's pretty hard to find even a coherent description of the details of the NTFS structure. The real problem here is that a major recovery operation is needed, and playing around with an unknown program isn't necessarily the best thing to do - if you have access to someone who has a program likely to work and who already knows how to use it. John |
|
14 May 04 - 10:02 AM (#1185672) Subject: RE: Tech: Are dumped files really gone forever? From: Bill D here is one that was recently noted in alt.comp.freeware http://handyrecovery.com/ HandyRecovery ~548Kb Handy Recovery is an easy to use program designed to restore files accidentally deleted from a hard disk or a diskette. The program can recover files damaged by virus attacks, power failures and software faults. If some program does not use Recycle Bin when deleting files, Handy Recovery can restore such files. It can also recover files moved to Recycle Bin after it has been emptied. With Handy Recovery you can browse the content of your disk like you do it in Windows Explorer. The only difference is that you see deleted files and folders along with the regular ones. Deleted files are marked with special icons. This helps you easily find the file that you need to recover. Recovered files can be saved to any disks accessible on your system. You can also restore the full branch of folders tree containing selected files and folders. Along with the main file data, the program can recover alternative data streams which are used on NTFS file system to store additional information about files. Handy Recovery works under Win 95/98/Me/NT/2000/XP/2003 operating systems. The program supports all Windows file systems for hard and floppy drives including FAT12/16/32 and NTFS/NTFS 5. |
|
14 May 04 - 10:08 AM (#1185675) Subject: RE: Tech: Are dumped files really gone forever? From: JohnInKansas Rapaire - Sometimes, with sophisticated and expensive special equipment, it is possible to recover something that's been overwritten once or even twice, but many of the disk utilities include a "disk wiper" utility intended to prevent such recovery. The US Government considers anything that's been overwritten 6 times as generally not recoverable by any means available to foreign espionage agents. Their stuff is as good as ours. The typical "secure wipe" writes an 01010101... sequence followed by a 101010... followed by a 111111... followed by an 0000... to all "empty clusters." Two passes (8 overwrites) is considered "secure" but it's usually repeated 6x to meet the DoD "Tempest" secure wipe spec. With the right equipment, damaged drives are fairly easily (not necessarily cheaply) recoverable, since the platters can be removed and mounted on a new shaft if needed. Most "drive failures" are because the motor quit, or the bearings failed. Alignment is pretty critical, but all that's really needed is to "make the disk(s) spin again." This is the "bread and butter" business for the data recovery guys. Some of them may pull up something that's "once overwritten" if you can tell them what they're looking for, but it would have to be a "matter of national security" to be worth going further than that. Older drives often suffered "disk collisions" where the read/write head hits the surface of the disk and plows furrows in it. So far as I know, no one has found a way to "unfurrow" this kind of failure, when the disk surface is damaged. Sometimes a "collision" only misaligns the heads, and then a recovery service can just "bend them back" and read the disk. This kind of failure is extremely rare in "modern" drives (floppies and ZIP drives excepted, where it's still far too common). Do we need to say "Backup your data?" John |
|
15 May 04 - 03:48 AM (#1186054) Subject: RE: Tech: Are dumped files really gone forever? From: Liz the Squeak Guest of 13 May - the question had already been admirably answered by various postings, I was just trying to inject a little humour and hope into what could be a devastating situation. It need not have been the FBI but I doubt most people know who the IRITDRS are. I sincerely hope that your stuff gets found, I know I'd be gutted if mine were all lost. Married as I am to an systems analyst, I suspect our backups are pretty regular. If not... physician, heal thyself! LTS |
|
15 May 04 - 04:57 AM (#1186077) Subject: RE: Tech: Are dumped files really gone forever? From: GUEST,Skipjack K8 I think it was possibly the apostrophe abuse that made the bile rise, Betty. Some people! |
|
15 May 04 - 05:30 AM (#1186082) Subject: RE: Tech: Are dumped files really gone forever? From: Dave the Gnome From your first posting kat it sounds like you have a new disk. If so you can follow the same route I took to recover from a corrupt disk. Take out the old disk and put in the new one set to be the primary disk. Set your old disk to secondary and then put it aside. Install Windows or whatever and a good recovery program like Norton. Shut down your PC and install the old disk alongside the new as the secondary disk. Reboot and use the recovery program to get your data back from the secondary disk, Does that help? Cheers DtG |
|
15 May 04 - 07:07 PM (#1186476) Subject: RE: Tech: Are dumped files really gone forever? From: Liz the Squeak But it's possessive, as in the fart belonging to the angel! LTS |
|
15 May 04 - 08:12 PM (#1186510) Subject: RE: Tech: Are dumped files really gone forever? From: JohnInKansas LTS - But you had "angels' fart." They do it collectively? "All together now - for the BIG ONE!" John |
|
15 May 04 - 08:17 PM (#1186516) Subject: RE: Tech: Are dumped files really gone forever? From: Rapparee JIK, That's what I tell folks -- if a government agency wants your data, you aren't going to keep them out. If they want to break into your computer, they will. My brother tells me of a program he used at the Law Enforcement Training Center in Georgia which in effect "freezes" a hard drive and allows you to look at it (so to speak) from different directions. I myself have two, perhaps three, different password crackers in my "cracking kit" at work -- one brute force, one for Novell versions 5 and under, and (I think) another which shoots common passwords at a computer. And that was just when I was System Administrating some four years back. I suspect that l0phtcrack, et al. are better today. Of course, back then I was dealing with Unix machines, not Windows, and perhaps a Novell network. Personally, I use the wiper that came with Norton Systemworks. Also the recovery program there. I really, really, don't want to deal with a full-blown disk recovery again -- once was plenty, and that was with a three-day-old full backup tape and a minute-to-minute operations backup tape. Thanks, but I'd rather not! |
|
15 May 04 - 08:33 PM (#1186521) Subject: RE: Tech: Are dumped files really gone forever? From: Geoff the Duck I'm sure I read that at the end of the world we should expect to hear "The Final Trump!" Quack! GtD. |
|
15 May 04 - 11:41 PM (#1186585) Subject: RE: Tech: Are dumped files really gone forever? From: katlaughing Thanks, again, for all of the on-topic advice. (I think we need a toilet plunger for Mudcat...the "crap" seems to keep rising.) Rog has brought Norton Recovery and Utilities home, so I'll give it a go. Experts here charge at least $75 per hour and that's if I bring it to them. kat |
|
16 May 04 - 12:02 AM (#1186597) Subject: RE: Tech: Are dumped files really gone forever? From: GUEST,.gargoyle Most happy to see you following my adivce...kitty, kat, kat, clone, kat.
Cheap Tricks - also has a VERY viable solution. Install a second "main=-boot" HD and make your original its slave....then read the data.
I was called in to restore a machine last summer. I worked every DOS and Norton trick/solution I could ... for 8 to 12 hour days....three days in a row. I was pissed, agrevated, petulant beyond my normal self.
A second 40 gig HD at 60 dollars - saved either the owner's life or my own life - because we were both ready to rip-out-throats.
I hope your Wyoming book was not lost.
Sincerely, |