Link to home
Start Free TrialLog in
Avatar of marathonman330
marathonman330

asked on

Data recovery on hard drive after another drive has been copied to it using Norton Ghost???

Using Norton Ghost I have successfully copied a hard drive (#1) to another used hard drive (#2).  I now realize that there may have been data on the destination drive (#2) that I need.  What are the chances I can recover data in this situation and what tools would you recommend?  Thank you.
SOLUTION
Avatar of Johnfdi
Johnfdi

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of Johnfdi
Johnfdi

free recovery software isn't going to be able to recover the data, the only method is to read the current data, subtract that from the magnetic signal and examine the residual data, and that involves very expensive analog equipment. MoD can do it and probably OnTrack can but not with software running on the PC.
ASKER CERTIFIED SOLUTION
Avatar of nobus
nobus
Flag of Belgium image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
I did the same thing and used a utility called File Scavenger

http://www.quetek.com/prod02.htm

It all depends if the same sectors have been overwritten but its worth a try

Hope this helps
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of marathonman330

ASKER

I've tried several of these products in different ways.  When I try to recover the file system, the result has been prettty much the same.  They come up with a few directories that I don't even recognize with garbage in them.  IRecover was able to recover a few files with their actual names but then I wasn't able to open them.  I tried finding lost files with RecoverMyFiles and it did find many files that I was able to preview but they didn't have their original file names or directory structure, which in this case is a big problem.  I know that I've pretty near exhausted my options but was wondering if anyone had any specific ideas on how to configure these programs to better find files with their names and folders.  Also, might you get better results by trying more than once?  Thank you all for your help.


Did you try file scavenger but remeber to search for deleted files

 I did the same thing and used a utility called File Scavenger

http://www.quetek.com/prod02.htm

It all depends if the same sectors have been overwritten but its worth a try

Hope this helps
In extreme cases i've had to send my drive off to On Track.  They've always pulled the recovery off for me.  For a fee, they evaluate the drive, and tell you what it's gonna cost.  That may be the last resort, but wishing you luck, don't give up!

...checking my resources for other solutions to this Q.

- gurutc
My last comment posted above pretty much sums up the best I was able to do.  File Scavenger was not successful in this case.  Thank you all for your help.
So which of those programs recovered your data since I was obviously wrong stating that software recovery products would not work in such a situation as you didn't accept that as an answer?
IRecover recovered some files with their names but I wasn't able to open any of them.  Stellar Phoenix and RecoverMyFiles recovered many files that I am able to open but their filenames are lost.
So basically IRecover made up some filenames and associated junk with them and RecoverMyFiles created useless files with dubious content. Like I said at the start, these software tools will not work after another image has been loaded onto the disk, it overwrites too much. Analog forensic recovery is required and that costs a packet.
IRecover didn't make up filenames.  It somehow found actual flenames but the files associated with them could not be opened so this wasn't helpful.  Stellar Phoenix and RecoverMyFiles actually recovered many files that were intact and could be opened but without the original filenames.  It would have been much better to get these files with the original filenames but this was still very helpful.  Analog forensic recovery may have completely done the job but the cost is not an option for me.  Thank you.