Data Recovery

May 4th, 2005 at 11:24pm

As mentioned in one of my previous post, I lost some data on one of my partitions. Here is a analysis of data recovery. What when wrong, and what could have been a better data recovery operation!

Let me tell you what you need to keep in mind when you do data recovery and also analyze what went wrong in my case.

Point Zero) Prevention better then cure. Have backups. Make sure that you don’t format or delete the partition which has data!. Think twice. !! I would advice one to browse through the partition once and look for important data. (but this step is not always possible!) [This one went wrong terribly for me. No backups. I did not have a option to browse the hard disk. Also, I thought that there was no significant data on that partition. But later (much later, infact), i realized that there was some old data as well as my PSTs in that partition. All said, data is data, New or old.]

If you have still managed to screw up (like i did :D) Here are the learnings :

1. First and the foremost, don’t panic.[No issues here for me]
2. If the data is important, and you are new to all this, and you don’t know what you are doing, then, don’t do it. Take it to some vendors who will do the data recovery for you.[I had done data recovery on more then half a dozen of hard disks! - but still i managed to format, and loose some data :)]
3. Once you know that you have formatted or deleted a partition accidentally, and that the data is lost, do not write anything onto that area. If you write anything, the existing data in that area is over written, and the chances of data in that area being recovered is next to zero. Actually, when you format the hard disk, (or delete a partition) the data itself is not removed from the hard disk. It would still exists. Only the means to reach that data is removed when you format. A analogy would be a huge book with lots of pages. Formatting removes off only the table of contents of the book. The pages will still be present. Now, if you over write the pages, then the old data is lost. [In my case, what happened was, i had a 6 GB area to be recovered. I assumed that there was no significant data as mention above, and installed Windoze 98 on to that area. So, around 1 GB of data straight off gone.]
4. This point is something that never striked me. Now, if you can boot into another OS on your machine (may be on another partition/hard disk), then before you boot up, make sure that this OS does not create a swap file or any temp file on the partition that you had data in. [In my case, C drive was lost, but I managed to boot to WinXP on D drive. But, later i realized that i had asked WinXP to use C drive for the swap space. So, WinXP happily created a 1GB swap file on C Drive. So one more GB of data gone on boot. I realized it after two boots, so, some more data gone! Booo..]
5. Next step, use appropriate tools to recover the data. The best tool that i have ever come across, was one named Tiramisu. This was around 6 to 7 years back, when the Chernobyl virus hit one of my friends machines and his hard disk was corrupted. Using this tool, we could recover a decent amount of data. Now, Ontrack has bought Tiramisu I guess. Other tools available :
   • Easy Recovery Pro (from Ontrack)
   • Active@ Undelete
   • Recover My Files

   [I used a combination of the above programs to recover some of my data. I could manage to get part of my mails, after using the SCANPST.EXE tool]

6. Backup your files![I got a replacement DVD writer today. Will burn some of my data!]

One good thing is, I did not loose many recent mails…because for the past year or two, i have been using web-mails like GMail and yahoo. Thats one good thing about these free mail providers.

Anyway. I hope this data recovery analysis helps people. Any other tips/suggestions most welcome!

Entry Filed under: General,Technology