• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 282
  • Last Modified:

I just ghosted one disk to another.... I choose the wrog destination disk

Exacltly.....

Now I have 2 disks with the same useless data.... the data I was trying to preserve was overwritten.

Guess there is nothing I can do... or is there? There is no other backup...
0
robrodp
Asked:
robrodp
  • 11
  • 11
  • 2
  • +5
6 Solutions
 
saw830Commented:
Hi,

That sucks.  I've always been afraid of doing just that.  I would stop now and contact a data recovery company.  Depending on the value of the data this could easily be cost prohibitive to get fixed.

Sorry to hear of the trouble.  Good luck,
Alan
0
 
robrodpAuthor Commented:
Any recovery company you recommned?
0
 
garycaseCommented:
It actually depends on how much data was on the source disk you used and what program you used to do the copy (I presume "Ghost", but that's becoming a common term that may refer to a different imager).   If there was not a large percentage of the disk in use, then it may be possible to recover at least a reasonable percentage of the data on the drive -- but not with any simple recovery tools.

I'd suggest you give the folks at Gillware (www.gillware.com) a call and see what they suggest.   IF they think there's a chance, they'll tell you -- and by data recovery standards they're very reasonably priced (~ $380).   They also have a "No Recovery, No Fee" policy -- although I'm not sure if it applies to this type of recovery.   In any event, they'll give you a quick, honest appraisal of your situation on the phone.
0
What Security Threats Are We Predicting for 2018?

Cryptocurrency, IoT botnets, MFA, and more! Hackers are already planning their next big attacks for 2018. Learn what you might face, and how to defend against it with our 2018 security predictions.

 
Juan OcasioCommented:
You could also purchase a software solution like Easy Recover Pro.  Install it on a computer, install the harddrive that had the image on it and then try to recover yourself..  As garycase mentioned, going to a professional is usually the best bet, but a lot of the software out there will do a pretty good job at data recovery.  The only real problem is you overwritten your data, so it may mangled.

Good Luck!!!

jocasio
0
 
robrodpAuthor Commented:
Mh.... the original disk was 120 GB and it eas overwritten with another 120 GB diak that was full.... about 90%. Talk about overwritten data. The more I think about it the more frustrated and anguished I become... all the files I lost keep on coming and it is a disaster....

Honeslty guys, I appreciate the intention... but I am ..... pretty stupid.

Thanks.
0
 
garycaseCommented:
... you've specifically overwritten the partition boot sector, the NTFS allocation tables, and the physical sectors necessary to store the data from the drive you copied.   That's why the primary issue here is how much actual data was on the "wrong" disk vs how much data was on the "good" disk.   If there was a lot of data on the "wrong" disk relative to the "good" disk, then your odds of recovery are small.   If there wasn't too much, and there was a lot of data on the other ("good") disk, then there's a reasonable chance that at least a modest amount of that disk can be recovered.

... needless to say, this is NOT a good situation.   As I noted above, call Gillware; describe exactly what you did and know the answers to my questions about how much data was involved; and they'll tell you if they think there's a chance here.   IF the data's recoverable, they'll get it done for you,  or let you know who can ==> they do suggest outsourcing some work to Ontrack for their more sophisticated multi-layering recovery equipment.   That equipment could probably get almost all of your data -- but the cost of that is measured in thousands, not hundreds.
0
 
robrodpAuthor Commented:
I am sure of that......

I might as wll not have come to work today or this week, this year for that matter...

Mh.... How long before I can sleep again?



0
 
garycaseCommented:
Well, the info you posted while I was drafting my last post makes it sound pretty bad.  I can pretty much tell you what Gillware would say -- call Ontrack if you really need the data, and plan on a few thousand dollars to recover it.   It IS possible to recover the last layer of data on a disk with a moderately high success rate, but it takes VERY expensive equipment and a good bit of time.   And Ontrack charges whether they succeed or not, so it could be a $2000 exercise in futility.

Stupid's not an appropriate word -- we all make mistakes.   Just learn from it and don't do it again :-)
0
 
garycaseCommented:
... in the "for what it's worth" department, I NEVER recommend ghosting a drive as a backup strategy.  For one thing, what you just did can happen.   For another, it's much better to use a backup/synchronization utility to copy all of your data -- that way it always exists at least two places.   For your system partition, it's a good idea to do fairly frequent images, so you can restore it if you ever get any corruption.   But even then, the image is just a file that you store somewhere, so unless you're INTENTIONALLY doing a restore, it won't hurt even if you store the image in the wrong place.

Just my nickel's worth ...
0
 
robrodpAuthor Commented:
Thanks....

My son just told me that if HE had made the mistake (on his PC) I would have lectured him to death on the importance of being carefull and bla bla bla.... and he is only 16.

I did not do it alone.... I was with a coworker who knows his stuff.... We hit enter saw all these files I had in my original disk being copied (overwritten?) we decided it was ok.

Is there a way to make an HD write protected with a jumper or something? I thought about it on a theoretical basis... now lived inthe flesh it makes much more sense.....

I guess I felt like a "He Man" you know "The bloddy mess on the floor was me".... And was not careful enough.

Ah ah ah....
0
 
garycaseCommented:
... I learned long ago never lecture someone on how careful you are, etc. ==> it will come back and bite you FAST.   There is a way to avoid writing to the wrong disk -- I use it on my video server (I have 3.5TB of stuff I wouldn't want to be mistakenly overwritten !!).   Simply keep the data on another computer, and when you share it on the network, make it read-only.   Of course when you're working on the same computer the drives are connected to, you still have to be careful.   As I noted above, the safest thing is to not "ghost" drives.
0
 
robrodpAuthor Commented:
As I said "The bloody mess on the floor is I"....

I will bite the bullet... life goes on...

Thanks
0
 
garycaseCommented:
You're most welcome.
0
 
bhanukir7Commented:
hi there

well sorry if i have not understood the story. the data u wanted to save was on disk1 and u tried to save it to disk2 but u saved it accidently to disk1 or is it that u also had data on disk2 which was to be saved and u lost that too.

because there are softwares which can recover data which has been lost by deletion but  not if overwritten so u can try to to recover atleast some amount of data that has not been over written.

the data is lost only if u format the disk so u can try Easy recovery professional edition to check what can be retrived.

as all have advised recovery of data is possible only from crashed disks not over written disks.  

but u can also try system mechanic which may also try to recover the data which has been deleted.

pls post back

bhanu
0
 
Yancey LandrumTechnical Team LeadCommented:
Recovery of data IS possible with overwritten disks/files, but unfortunately, you are going to need to use a service, or get Encase forensic software (basically, something or someone who can recover overwritten files using shadow data or ghost data).

In a nutshedll:
Ghost data looks at the subtle variations of the magnetic bits to see what the value was previously (for example, a 1 which overwrote a 1 is magnetically a slightly stronger 1 than a 1 that overwrote a 0). This type of variation analysis can ofter find overwritten data up to 7 layers back.
Shadow data looks for very slight misalignments in data tracks to see what was there previously. Think of a sheet of paper on top of another sheet of paper where you can see a very small strip of the bottom sheet due to very slight offset of the top sheet.

OnTrack (the service, not the software) usually starts in the same price range mentioned above, but can go into the thousands of dollars, and EnCase ain't cheap either. It really depends on how much the data is worth to you.

And remember; "Experience is what you get when you DON'T get what you want."
0
 
garycaseCommented:
robrodp -- don't forget to close the question :-)     ... and you might still want to call Gillware and just discuss this with them;   I think I pretty well summed up what they'll tell you, but they may have some additional insights.

0
 
bcomfortCommented:
My $0.02...

120 GB of what kind of data on what type of FS?
The point being here that if it was mostly applications then the small critical
data may be recoverable (without worrying about the installed stuff)
since they would most likely take up a few sequential blocks and not
be spread all over the drive.

If the drive was full of a few large files (Database) then recovery of those
large files is unlikely because there will be so many "holes" in the
file structure that a cohesive read is unlikely.  Any "blob" data in a
large database file would be very likely lost.

I've successfully used Encase to recover some data from situations like this
but a full drive recovery is approaching 0%
The longer you wait as well, the more the magnetic "echos" (ghost data) will fade as they
are affected by ambient magnetic fields and the much stronger present data
This makes it harder to determine with any certainty what was overwritten.


0
 
robrodpAuthor Commented:
120 GB on an IDE HD (What is FS?)

Basically both types of data... database and small app files.

Wat is endcase?
0
 
garycaseCommented:
I think FS means file system.  

EnCase is a forensic recovery system for hard disks:  http://www.guidancesoftware.com/products/ef_index.asp
0
 
robrodpAuthor Commented:
Any idea who sells encase?
0
 
bcomfortCommented:
Yes, sorry FS=Filesystem

If it's an NTFS drive that was reasonably defragged and
a well preserved MFT (Master File Table and journal) vs. FAT32 vs.
EXT2 or EXT3 (I never did hear if this was linux or FreeBSD or some
other *NIX) then the recoverable bits would differ.

Encase is sold by Guidance software (see garycase's link)
or FDR if you're in Canada http://www.forensicdata.ca/pages/product_template.php?p_id=35

The cost is between $2.5 and $4K depending on your industry and
the options you'd like.

There is a great deal to know WRT Encase and you can spend a lot
of time and money for no gain (better to get someone certified to
assist you).

One more thing.  Keep the HD powered down and in an anti-static
bag in a cool place and WELL packaged if you ship it out to anyone
for data recovery.

Good Luck!




0
 
robrodpAuthor Commented:
Thanks
0
 
garycaseCommented:
Folks like Gillware, OnTrack, etc. have this kind of software -- as you can see from the pricing, it's not generally cost-effective for a one-off recovery; and it has a very extensive learning curve.
0
 
ort11Commented:
From a few questions up.  Check the specs on the hard drive and sometimes they do have a hardware write disable jumper on the drive.  This used to be more common and it may only be on SCSI drives, etc.  If the data is important I usually look for a hardware write protect jumper on the drive.  May save future problems.

0
 
robrodpAuthor Commented:
Right...

I am sleeping. First it was my disk.... Had it been a clients I wouldbe in deeper filthier waters. That is a releief... sort of. A few months from today it wll be and anecdote to remmeber never to be forgotten in this area and many others (Insure your car for example).

For ghosting:

Problem is with the ghost program cannot tell which disk is which if they have the exact same specs.

Simple solution.

You take the target disk, remopve all partition data and ghost will not let you chhose it as a origin disk only as target.  Simple Ah?

garycase's comment: ... needless to say, this is NOT a good situation (what an understatement!) made me laugh when I really needed it.

Trying to use the magnetic traces of the disk in second layers and so forth though 100% feasible reminded me of the bing bang.

Thanks to all.

0
 
garycaseCommented:
You're most welcome.   I got a particular kick out of your comment "... My son just told me that if HE had made the mistake (on his PC) I would have lectured him to death on the importance of being carefull and bla bla bla.... "  ==>  I suspect there's some truth in that (and it made me think what I might have said to my kids had they ever done something like that).    I suspect that NOW if your son ever made such a mistake you'd be a bit more understanding :-)  :-)  :-)

0
 
robrodpAuthor Commented:
Absolutely...

Since there was no "solution" as such I will award points later. I guess all involved are entitled to some.
0
 
garycaseCommented:
There was, of course, an answer -- perhaps just not the one you wanted to hear :-)

Your question:  "Guess there is nothing I can do... or is there?"  

The Answer:  Several possibilities were discussed above (Gillware was probably the most likely to succeed);  but your subsequent posts provided information that made it clear that the likelihood of success was very low.   I'd agree that the bottom line is "No, there's nothing you can do" (at least nothing that has much change of success -- and even those would cost a healthy chunk of change).
0
 
robrodpAuthor Commented:
I posted the word "solution" (quoted) because there is no practical solution to the data recovery. The answers have been enlightning to be sure, the question was rethorical...

So do not misundestand me, I just pointed that out for the closing of the matter.
0

Featured Post

A Cyber Security RX to Protect Your Organization

Join us on December 13th for a webinar to learn how medical providers can defend against malware with a cyber security "Rx" that supports a healthy technology adoption plan for every healthcare organization.

  • 11
  • 11
  • 2
  • +5
Tackle projects and never again get stuck behind a technical roadblock.
Join Now