5 replies to this topic

[Nare]

The end request is simple: I need a portable version of certain data recovery softwares, GlaryUndelete and/or UndeleteMyFilesPro, both of which are free. They need to be able to run from Mini Windows XP (Hiren's Boot CD) or a Win 7 32 bit that I have on a USB as a Live PE. I HAVE tried it myself and other data recovery tools and they work to varying degrees, some even attempt to scan and recover but the files don't actually get transfered. So I need someone that can maybe do those for me in portable versions because I do not have the means or knowledge for it.

The problem is kind of delicate: an old laptop (so hard to work straight on hard disk), where the Windows partition was fully stacked (100% space) and then got attacked and most files on it were "deleted". They are all still there, but it's basically a lot of files, so it's important to save them up as well as various settings by categories and folders, which is why only certain data recovery softwares would do because I need a folders view/save function on them. But ironically those are the ones that are hardest to make work as portable versions, namely those two.

I won't get into all the details for why I concluded to handle it this way and all the problems I had but I will answer if asked. And I have attempted to try and use these recovery software which are Windows exclusive on it in various roundabout ways but the "make them portable" is best choice so far.

Using Cameyo I made portable versions of a lot of softwares, from Win 7 64 and even a Virtual Box'd Win XP, but I did not get the exact results I hoped for. From researching, the OS on which they are built matters a lot, which is why I tried a Win XP virtual box, but I do not have the means for Win 7 32 bit. There are also other services and software for making portable apps out there, but I do not have the time or the money at this point.

I am no longer on a Windows machine for a while too so I can not work on this myself anymore, so I figured instead of wasting more time, I would maybe ask for help in the mean time. If someone could give me a hand with this it would mean a lot. Thanks.
 

Tl;dr in a nutshell: can someone on Windows 7 32 bit help me?

[paws]

When dealing with recovering data from a hard drive a very important consideration is NOT to boot any operating system or write any data to the hard drive concerned....
 
Even booting into Windows is enough to overwrite data that has been marked as non available (deleted) and overwriting data makes the job of file recovery more difficult or even impossible for ordinary folks. Therefore even starting Windows a few times can make for great difficulty in data recovery.
 
Take a look at the free portable version of Recuva

https://www.piriform...ortable-version

 

Regards

paws

[Nare]

When dealing with recovering data from a hard drive a very important consideration is NOT to boot any operating system or write any data to the hard drive concerned....
 
Take a look at the free portable version of Recuva

https://www.piriform...ortable-version

 

I did not boot anything from that partition nor made any real changes to it. Windows from that partition won't even boot. I did use USB bootable tools with Linux and the like, which I imagine wouldn't really cause problems as they are not on the partition right?
 

And I did try many things for that recovery, including portable Recurva. I like it, it is the best one for these kinds of things if it wasn't for a simple problem: there's too many files. That is why I need a folder view and restore function, which unfortunately is the only thing missing in Recurva. I DID notice it has a feature called "restore folder structure" but connected to some overwrite options so I figure it's not what I want?

 

All I need at the moment is at least someone who has Windows 7 32 bit or can Virtual Box it for making some portable versions real quick.
 

[paws]

Its good to hear that you don't think you have allowed any application including the operating system, to write anything to your hard drive, so if that is correct then it increases your chances of making a successful recovery.

 

The normal procedure in these sorts of situation is to use a hardware "write blocker" to ensure that nothing at all (inc temp files etc) are written to the hard drive, then a disc image (or two) is taken  the disc image being used for the recovery process, keeping the original hard drive in its existing state, as your "fallback position"

 

Recuva seems to be your best bet if you are determined to carry on with the recovery without seeking the services of a professional data recovery company.

 

Its good that Recuva has identified and can recover your files, if it cannot recover your folder/directory structure for any reason then once you have your important files copied safely across to removable media (not your internal hard drive!) then if you wish to file your stuff into folders then it should be a simple procedure to recreate your desired folder structure manually.

 

Once you have achieved this it will be wise to revisit the back up strategy, in place for the laptop to see what went wrong,  we often advise our customers (in the workshop)  that there should always be at least 3 separate copies (verified) of all important files/folders, all on removable different media and with at least one copy kept safe offsite. Disc images in addition to the data back ups enable the operating system to be up and running again in less time than it takes to walk the dog in the event of a software or operating system problem.

 

If you cannot achieve the desire results using Recuva then maybe it would be better to consider using a professional data recovery company as those folks can often work wonders in recovering stuff. The only disadvantage is that the good ones cost a fair amount of money to perform their wizardry. However if the data is really important and all your back ups have failed then its well worth considering.

 

The costs are dependent to a certain extent on the amount of data to be recovered, the state, both physically and electronically of the drive concerned and the overall complexity of the problems.

 

You should be thinking in terms of thousands rather than hundreds of dollars (USD) however you could be lucky and find that it costs considerably less.

Regards

paws

[Nare]

I tend to imply too much or complicate things. My problem is actually really simple: I CAN easily access all deleted files but I need the recovery to be organized. The only tools that allow me that are unfortunately Windows only, yet because this is a laptop and to make sure nothing is overwritten it's tough to even get in a position where I can run ANY data recovery tools on that partition. All I need then is someone with the time and expertise to make them work as portable until there's a breakthrough. I would have continued at it alone myself, but no Windows machine at the moment.

My reason for posting on a forum then was to reach a wider audience to find someone and/or make it happen faster with some organized team effort. But I probably advertised it wrong and overcomplicated what I need so I may try again.

I absolutely NEED to be able to data recovery via folders. I may love Recurva but there's two major problems there:

1) Since the entire partition is deleted there is just a LOT of pointless data files, like .dat .mpq, just various stuff from installed programs or windows folder and so on that gets found on search. And I can not afford to leave anything out by doing specialized searches. Even if I do a scan for just docs, vids, pics the problem is I also need to recovered installed program settings to a large degree, hence the reason for needing folders.

2) Even if I only get the media and doc files, and anything else I can find with Recurva, I would still need months to organize it back manually, and that's IF I have the time which I just do not (I am always very organized and thorough with my files and folders so it will be a pain to get it back).

It's all just a "so close, yet so far" type of scenario, which is why it's so frustrating. The files are there, I saw the folders with data recovery scans, but the folders just can't get transfered and saved when I click "recover" so I really just need help at this point. At least the good news is that I won't be needing to go to pay for any data recovery services.

I do appreciate your advices on data recovery though, there is even some new info so I need to ask something:

1) Write Blocker? I would have loved it if it was software, but might be weird to get one on a laptop, and a pointless payment if this works out soon enough, but I will look into it. Do you reckon I should given that this comp is like this and have used it off USB for some time+not really using said partition at all?

2) I CAN and DID do a disk image backup with one tool. But it was an SQL file that I didn't know what to do with so I deleted it. I can do it again, if you can help me figure out how to open/access it and maybe I can recover things that way?

[paws]

Hi Nare,

If you are not experienced in data recovery procedures then my best advice would be to leave it to a professional data recovery firm, hand them the computer, tell them what you want and ask for a quotation.

Remember even switching off the computer will have an effect on data.... even data held within RAM is volatile to the extent that it is likely to be lost when the power is removed.

 

My comments about "write blockers" refers to the need to be sure when performing data recovery that nothing is overwritten (making the job more complicated) or in a courtroom scenario, calling into question the integrity or provenance of the data on the hard drive concerned. Both hardware and software blockers are available, but these are usually tools that a forensic investigator, or someone who was concerned with data integrity would use.

 

Your disc image resulting in a sql file sounds very odd to me.... as it would not be usual to keep all ones files/folders within a database environment, however  it might be useful to try and use another disc image that you may have available (perhaps you used native Windows tools for this or third party applications like, Acronis, Macrium, Symantec, or any other Windows or Linux disc imaging tools

 

If you are determined to deal with this yourself rather than engage a professional firm then you should proceed with utmost caution, only work on the disc image not the actual hard drive in question!

 

If you are not satisfied with Recuva's undoubted abilities to achieve your objectives then you could look at other tools...

 

HOWEVER here's a warning for you....

 

You will need to do a lot of research and reading to equip yourself with even a basic knowledge of data recovery and it will take time and effort on your part to achieve the level of proficiency required for a satisfactory outcome. If you are not prepared to invest the time and effort needed, then it would be better to contact a professional data recovery firm now.

 

It will be a lot easier for you to have a dedicated forensic machine available to you to assist with the recovery. It is suggested that before operating on the system from which you wish to recover the data that you set up a similar installation on your forensic machine with an appropriate folder/directory structure, (any data will do as long as you keep good records of exactly what it is and the structure and content) and then deliberately delete it all, or the partition concerned....(you need to replicate as far as possible the calamity that happened to the original hard drive in the laptop.) you can then try your newly acquired data recovery skills to recover the data and folder/directory structure..... It's important that you keep a real time log of every action you take, (time date action, results etc., ( just as you would for any forensic examination)

 

When you achieve your objective then its time to rejoice but also to replicate the practice by using another data/folder set and repeating the process..... you should find it easier the second time. Compare your two logs and you should see where time was lost

(or misspent) on the first attempt and you should be able to streamline your approach for your next practice run....

 

It's an iterative process and it's difficult to say how many practices you will require before you feel sufficiently confident to tackle the real job, but I would certainly not consider fewer than say 7 or 8 successful recoveries... however, as always, it's your machine and your call.

 

Here are some free tools that may assist you if you are keen to do it yourself...

 

 http://www.e-fense.com/products.php

The free version (Helix V3 is still available) and provides a gateway into some powerful forensic recovery tools

 

https://www.linux.co...-recovery-tools

 

http://www.system-re...scueCd_Homepage

 

Once you have experimented with a few of the tools and done a few practice runs, the costs of professional data recovery will perhaps not seem to be too bad!

 

I don't think that on a forum here I can go any further with this topic as the rest is up to you!

However I wish you all the best  for a successful recovery

Regards

paws